WooYun.org

涉及文件：
r1d(2.8.16)\usr\lib\lua\luci\controller\service\datacenter.lua
r1d(2.8.16)\usr\sbin\thrifttunnel elf执行文件
THRIFT_TUNNEL_TO_DATACENTER = "thrifttunnel 0 '%s'"
entry({"api", "xqdatacenter", "request"}, call("tunnelRequest"), _(""), 301)
function tunnelRequest()
local XQCryptoUtil = require("xiaoqiang.util.XQCryptoUtil")
local payload = XQCryptoUtil.binaryBase64Enc(LuciHttp.formvalue("payload"))
local cmd = XQConfigs.THRIFT_TUNNEL_TO_DATACENTER % payload
local LuciUtil = require("luci.util")
LuciHttp.write(LuciUtil.exec(cmd))
end
function upload()
local fp
local log = require("xiaoqiang.XQLog")
local fs = require("luci.fs")
local tmpfile = "/userdisk/upload.tmp"
if fs.isfile(tmpfile) then
fs.unlink(tmpfile)
end
local filename
LuciHttp.setfilehandler(
function(meta, chunk, eof)
if not fp then
if meta and meta.name == "file" then
fp = io.open(tmpfile, "w")
filename = meta.file
filename = string.gsub(filename, "+", " ")
filename = string.gsub(filename, "%%(%x%x)",
function(h)
return string.char(tonumber(h, 16))
end)
filename = filename.gsub(filename, "\r\n", "\n")
end
end
if chunk then
fp:write(chunk)
end
if eof then
fp:close()
end
end
)
local path = LuciHttp.formvalue("target")
if string.match(path, "\/$") == nil then
path = path .. "/"
end
fs.mkdir(path, true)
local savename = filename
if fs.isfile(path .. savename) then
local basename = savename
local index = basename:match(".+()%.%w+$")
if index then
basename = basename:sub(1, index - 1)
end
local extension = savename:match(".+%.(%w+)$")
for i = 1, 100, 1 do
local tmpname = basename .. "(" .. i .. ")"
if extension then
tmpname = tmpname .. "." .. extension
end
if not fs.isfile(path .. tmpname) then
savename = tmpname
break
end
end
end
local dest = path .. savename
log.log(3, "dest=" .. dest)
fs.rename(tmpfile, dest)
local result = {}
result["code"] = 0
LuciHttp.write_json(result)
end
关键api函数，参数无过滤带入thrifttunnel 0 '%s'执行。 可实现文件复制及替换功能 详见exp。